12VAC35-105-870: Records management policy

A. The provider shall develop and implement a written records management policy that describes confidentiality, accessibility, security, and retention of records pertaining to individuals, including:

1. Access, duplication, dissemination, and acquisition of individual information only to persons legally authorized according to federal and state laws;

2. Storage, processing, and handling of active and closed records;

3. Security measures to protect records from loss, unauthorized alteration, inadvertent or unauthorized access, disclosure of information, and transportation of records between service sites;

4. Strategies for service continuity and record recovery from interruptions that result from disasters or emergencies, including contingency plans, electronic or manual back-up systems, and data retrieval systems; and

5. Disposition of records in the event that the service ceases operation. If the disposition of records involves a transfer to another provider, the provider shall have a written agreement with that provider.

B. The records management policy shall be consistent with applicable state and federal laws and regulations related to privacy of health records, including:

1. Section 32.1-127.1:03 of the Code of Virginia;

2. 42 USC § 290dd;

3. 42 CFR Part 2; and

4. The Health Insurance Portability and Accountability Act (Public Law 104-191) and implementing regulations (45 CFR Parts 160, 162, and 164).

C. The policy shall specify what information is available to the individual.

D. Active and closed records shall be kept in areas that are accessible to authorized staff and protected from unauthorized access, fire, and flood.

E. Entries in the individual's record shall be current, dated, and authenticated by the person making the entry. Errors shall be corrected by striking through and initialing.